Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2006-1174

useradd in shadow-utils before 4.0.3, and possibly other versions before 4.0.8, does not provide a required argument to the open function when creating a new user mailbox, which causes the mailbox to be created with unpredictable permissions and possibly allows attackers to read or modify the mailbox.

Published

2006-05-28T23:02:00.000

Last Modified

2025-04-03T01:03:51.193

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 3.7 (LOW)

CVSSv2 Vector

AV:L/AC:H/Au:N/C:P/I:P/A:P

Access Vector: LOCAL
Access Complexity: HIGH
Authentication: NONE
Confidentiality Impact: PARTIAL
Integrity Impact: PARTIAL
Availability Impact: PARTIAL

Exploitability Score

1.9

Impact Score

6.4

Weaknesses

Type: Primary
CWE-264

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	debian	shadow	≤ 4.0.7	Yes
Application	debian	shadow	4.0.0	Yes
Application	debian	shadow	4.0.1	Yes
Application	debian	shadow	4.0.2	Yes
Application	debian	shadow	4.0.4	Yes
Application	debian	shadow	4.0.4.1	Yes
Application	debian	shadow	4.0.5	Yes
Application	debian	shadow	4.0.6	Yes

References

ftp://patches.sgi.com/support/free/security/advisories/20070602-01-P.asc ([email protected])
http://cvs.pld.org.pl/shadow/NEWS?rev=1.109 ([email protected])
http://lists.grok.org.uk/pipermail/full-disclosure/2007-September/065902.html ([email protected])
http://secunia.com/advisories/20370 Patch, Vendor Advisory ([email protected])
http://secunia.com/advisories/20506 Vendor Advisory ([email protected])
http://secunia.com/advisories/25098 Vendor Advisory ([email protected])
http://secunia.com/advisories/25267 Vendor Advisory ([email protected])
http://secunia.com/advisories/25629 Vendor Advisory ([email protected])
http://secunia.com/advisories/25894 Vendor Advisory ([email protected])
http://secunia.com/advisories/25896 Vendor Advisory ([email protected])
http://secunia.com/advisories/26909 Vendor Advisory ([email protected])
http://secunia.com/advisories/27706 Vendor Advisory ([email protected])
http://support.avaya.com/elmodocs2/security/ASA-2007-249.htm ([email protected])
http://www.gentoo.org/security/en/glsa/glsa-200606-02.xml ([email protected])
http://www.kb.cert.org/vuls/id/312692 US Government Resource ([email protected])
http://www.mandriva.com/security/advisories?name=MDKSA-2006:090 ([email protected])
http://www.redhat.com/support/errata/RHSA-2007-0276.html ([email protected])
http://www.redhat.com/support/errata/RHSA-2007-0431.html ([email protected])
http://www.securityfocus.com/archive/1/468336/100/0/threaded ([email protected])
http://www.securityfocus.com/bid/18111 Patch ([email protected])
http://www.securitytracker.com/id?1018221 ([email protected])
http://www.vupen.com/english/advisories/2006/2006 Vendor Advisory ([email protected])
http://www.vupen.com/english/advisories/2007/3229 Vendor Advisory ([email protected])
https://exchange.xforce.ibmcloud.com/vulnerabilities/26958 ([email protected])
https://issues.rpath.com/browse/RPL-1357 ([email protected])
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10807 ([email protected])
ftp://patches.sgi.com/support/free/security/advisories/20070602-01-P.asc (af854a3a-2127-422b-91ae-364da2661108)
http://cvs.pld.org.pl/shadow/NEWS?rev=1.109 (af854a3a-2127-422b-91ae-364da2661108)
http://lists.grok.org.uk/pipermail/full-disclosure/2007-September/065902.html (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/20370 Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/20506 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/25098 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/25267 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/25629 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/25894 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/25896 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/26909 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/27706 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://support.avaya.com/elmodocs2/security/ASA-2007-249.htm (af854a3a-2127-422b-91ae-364da2661108)
http://www.gentoo.org/security/en/glsa/glsa-200606-02.xml (af854a3a-2127-422b-91ae-364da2661108)
http://www.kb.cert.org/vuls/id/312692 US Government Resource (af854a3a-2127-422b-91ae-364da2661108)
http://www.mandriva.com/security/advisories?name=MDKSA-2006:090 (af854a3a-2127-422b-91ae-364da2661108)
http://www.redhat.com/support/errata/RHSA-2007-0276.html (af854a3a-2127-422b-91ae-364da2661108)
http://www.redhat.com/support/errata/RHSA-2007-0431.html (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/archive/1/468336/100/0/threaded (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/bid/18111 Patch (af854a3a-2127-422b-91ae-364da2661108)
http://www.securitytracker.com/id?1018221 (af854a3a-2127-422b-91ae-364da2661108)
http://www.vupen.com/english/advisories/2006/2006 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.vupen.com/english/advisories/2007/3229 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://exchange.xforce.ibmcloud.com/vulnerabilities/26958 (af854a3a-2127-422b-91ae-364da2661108)
https://issues.rpath.com/browse/RPL-1357 (af854a3a-2127-422b-91ae-364da2661108)
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10807 (af854a3a-2127-422b-91ae-364da2661108)